-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 # this file in the current directory . or /usr/local/etc prevents # spfilter from using the cached 'live' copy at all. # its safe to delete this file, spfilter.pl has all the xml embedded # the cleartext-signature will be verified if gpgv available in path. # - section 'preset' describes aliases for sources # - section 'source' describes input-sources (url) # - section 'format' describes output-formats # changes should be done exclusively in ./spfilter-local.xml # which # may be included with argument '-x ./spfilter-local.xml' # the trusted local config allows to override sources, formats # and most config-variables (not complete, work in progress) # use html-entities for this chars: '<', '>', '&' and '"' # XML-Viewer at http://spfilter.sourceforge.net/code/xml-view.php # Aliases listed here will be expanded recursively # the *_ALL variants are not meant for automated blocking # the *_SAFE variants should be safe for most mailservers # more aliases and sources may be added on request # update local copy below ./cache, verify gpg-signature # file still must be copied manually to the destination http://spfilter.sourceforge.net/code/xml-view.php 26BDCEF3 984C 6100 1C0E 5813 4077 6C48 051F C28D 26BD CEF3 http://pgp.mit.edu:11371/pks/lookup?search=spfilter&op=index&fingerprint=on http://spfilter.sourceforge.net/code/spfilter-config.xml.bz2 http://mirror.bliab.com/spfilter/spfilter-config.xml.bz2 http://spfilter.sourceforge.net/code/spfilter-config.xml http://spamhaus.org/sbl/ sbl.spamhaus.org may not be redistributed with another name http://mirror.bliab.com/sbl/SBL.cidr.bz2 http://spfilter.sourceforge.net/data/sbl/SBL.cidr.bz2 http://mirror.bliab.com/sbl/SBL.cidr.bak.bz2 http://spfilter.sourceforge.net/data/sbl/SBL.cidr.bak.bz2 http://spews.org/ also included in relays.osirusoft.com SPEWS2 http://spews.org/spews_list_level1.txt.bz2 http://spews.ghost.ru/spews_list_level1.txt.bz2 http://mirror.bliab.com/spews/SPEWS.cidr.bz2 http://spfilter.sourceforge.net/data/spews/SPEWS.cidr.bz2 http://spews.org/spews_list_level1.txt http://spews.org/ spews level 2 includes level 1, blocks faster and longer SPEWS http://spews.org/spews_list_level2.txt.bz2 http://spews.ghost.ru/spews_list_level2.txt.bz2 http://mirror.bliab.com/spews/SPEWS2.cidr.bz2 http://spfilter.sourceforge.net/data/spews/SPEWS2.cidr.bz2 http://spews.org/spews_list_level2.txt http://spews.org/ extract only parts referring to dynamic sources SPEWS SPEWS2 (OpenProxy|Cable|Modem|S456|S586|S1255) http://spews.org/spews_list_level1.txt.bz2 http://www.spamsites.org/ spamsites.relays.osirusoft.com also included in relays.osirusoft.com http://www.spamsites.org/j_ips.txt spamsites.org http://openrbl.org/# http://abuse.easynet.nl/blackholes.html http://blackholes.easynet.nl/errors.html blackholes.easynet.nl rsync://informatie.easynet.nl:6666/spamblock/permblockIP.txt PERMBLOCK http://abuse.easynet.nl/proxies.html http://proxies.blackholes.easynet.nl/errors.html proxies.blackholes.easynet.nl rsync://informatie.easynet.nl:6666/spamblock/rbldns/proxies.blackholes.easynet.nl/rbldns.proxies.blackholes.easynet.nl Open Proxy - http://proxies.blackholes.easynet.nl/errors.html http://abuse.easynet.nl/dynablocker.html http://dynablock.easynet.nl/errors.html dynablock.easynet.nl rsync://informatie.easynet.nl:6666/spamblock/rbldns/dynablock.easynet.nl/rbldns.dynablock.easynet.nl DynaBlock - http://dynablock.easynet.nl/errors.html http://www.pan-am.ca/pdl/ VERBOSE variant of PDL, appends hyperlink PDL_DIALUP http://www.pan-am.ca/pdl/pdl-list.txt.bz2 http://spfilter.sourceforge.net/data/input/PDL.bz2 PDL Dynamic List http://pan-am.ca/pdl/# http://www.pan-am.ca/pdl/ NON-VERBOSE variant of PDL PDL PDL http://www.pan-am.ca/pdl/pdl-list.txt.bz2 http://spfilter.sourceforge.net/data/input/PDL.bz2 PDL http://relays.visi.com/ rsl.visi.com update daily due to dynamic nature RSL is conservative, consider adding DSBL to the set http://relays.visi.com/rsl-list.txt.bz2 RSL Open Relay http://relays.visi.com/nph-l?ip= http://dsbl.org/ list.dsbl.org update daily due to dynamic nature zone file in rbldns format rsync://rsync.dsbl.org:873/dsbl/rbldns-list.dsbl.org DSBL Insecure host http://dsbl.org/ multihop.dsbl.org know the difference between single- and multihop-relays? zone file in rbldns format rsync://rsync.dsbl.org:873/dsbl/rbldns-multihop.dsbl.org DSBL Multistage Relay http://dsbl.org/ unconfirmed.dsbl.org do not enable this entry unless you know why zone file in rbldns format rsync://rsync.dsbl.org:873/dsbl/rbldns-unconfirmed.dsbl.org DSBL Unconfirmed psbl.surriel.com rsync://psbl.surriel.com/psbl/psbl.txt PSBL http://cbl.abuseat.org/ cbl.abuseat.org zone file in rbldns format rsync://rsync.cbl.abuseat.org/cbl/list.txt CBL Proxy/Trojan http://spambusters.org.ar pss.spambusters.org.ar no website/removal yet - please be patient zone file in rbldns format rsync://rsync.spambusters.org.ar/pss/rbldns.txt PSS Open Proxy http://www.drbl.ofisp.org/eng/ ALL listings imported - do not use for blocking http://mirror.bliab.com/contrib/drbl.all.bz2 http://www.five-ten-sg.com/blackhole.php blackholes.five-ten-sg.com zone not available 2002-10-27, maybe gone .exception not handled, dont use for blocking http://localhost/fiveten.axfr \.exception$ http://www.five-ten-sg.com/blackhole.php blackholes.five-ten-sg.com zone not available 2002-10-27, maybe gone .exception handled, may be used for blocking 120mb ram, 319650 records, 16mb octets FIVETEN http://localhost/fiveten.axfr FIVETEN \.exception$ http://www.five-ten-sg.com/blackhole.php blackholes.five-ten-sg.com .exception not handled, dont use for blocking FIVETEN FIVETEN http://localhost/fiveten.axfr Fiveten/Spamsource \.(spam|webform|bulk|singlestage|multistage|misc)$ \.exception$ http://www.five-ten-sg.com/blackhole.php blackholes.five-ten-sg.com FIVETEN FIVETEN .exception not handled, dont use for blocking http://localhost/fiveten.axfr Fiveten/Dialup \.dialup$ \.exception$ http://moensted.dk/spam/no-more-funn/ no-more-funn.moensted.dk .exception not handled, dont use for blocking http://moensted.dk/spam/no-more-funn/no-more-funn.moensted.dk.txt \.exc?eption$ http://moensted.dk/spam/no-more-funn/ no-more-funn.moensted.dk expand exception parents, may be used for blocking 206951 records, 9mb octets NOMORE NULL http://moensted.dk/spam/no-more-funn/no-more-funn.moensted.dk.txt \.exc?eption$ http://abuse.easynet.nl/dynablocker.html http://dynablock.easynet.nl/errors.html dynablock.easynet.nl ATTN: name changed to easynet.nl 2003-05-17 cname host used for description Please take a look at your logfiles every day and report any false positives to abuse@abuse.easynet.nl nodialup.ip not handled here, DONT USE FOR BLOCKING stats: 120mb ram, 375249 records, 16mb octets rsync://informatie.easynet.nl:6666/spamblock/dynablock.txt DYNABLOCK ^nodialup\.ip$ http://abuse.easynet.nl/dynablocker.html http://dynablock.easynet.nl/errors.html dynablock.easynet.nl ATTN: name changed to easynet.nl 2003-05-17 cname host used for description expand exception parents, may be used for blocking stats: 240mb ram, 798052 records, 18mb octets DYNABLOCK rsync://http://informatie.easynet.nl:6666/spamblock/dynablock.txt NULL ^nodialup\.ip$ http://www.uceprotect.net static list only, not available via dns http://www.admins.ws/download/access.gz UCEPROTECT Blacklisted - see http://www.uceprotect.net/en/ http://us.mirror.menandmice.com/cgi-bin/DoDig?host=ns1.intersil.com&domain=flowgoaway.com&type=AXFR netlist.flowgoaway.com http://mirror.bliab.com/contrib/flowgoaway.bz2 http://spfilter.sourceforge.net/data/contrib/flowgoaway.bz2 Flonetwork Mainsleaze http://hatcheck.org/google?pm0-no-more.compu.net maintained source needed Postmastergeneral Mainsleaze http://blackholes.us/ taiwan.blackholes.us http://blackholes.us/zones/country/taiwan.classful http://mirror.bliab.com/bus/country/C_TAIWAN.bz2 http://blackholes.us/ hongkong.blackholes.us http://blackholes.us/zones/country/hongkong.classful http://mirror.bliab.com/bus/country/C_HONGKONG.bz2 http://blackholes.us/ china.blackholes.us http://blackholes.us/zones/country/china.classful http://mirror.bliab.com/bus/country/C_CHINA.bz2 http://blackholes.us/ korea.blackholes.us http://blackholes.us/zones/country/korea.classful http://mirror.bliab.com/bus/country/C_KOREA.bz2 http://www.okean.com/asianspamblocks.html KOREA http://www.okean.com/sinokoreacidr.txt KOREA&CHINA Mail Rejected http://www.apnic.net/apnic-bin/whois2.pl?key= http://blackholes.us/ above.blackholes.us http://blackholes.us/zones/isp/above.classful ISP ABOVE.NET http://hatcheck.org/google?above.net; http://hatcheck.org/sbl?above http://blackholes.us/ affinity.blackholes.us http://blackholes.us/zones/isp/affinity.classful ISP AFFINITY http://hatcheck.org/google?affinity/skynetweb/valueweb; http://hatcheck.org/sbl?affinity; http://hatcheck.org/sbl?valueweb http://mirror.bliab.com/contrib/isp_att.bz2 http://spfilter.sourceforge.net/data/contrib/isp_att.bz2 ISP ATT.NET http://hatcheck.org/google?att; http://hatcheck.org/sbl?att http://blackholes.us/ bellsouth.blackholes.us http://blackholes.us/zones/isp/bellsouth.classful ISP BELLSOUTH http://hatcheck.org/google?bellsouth; http://hatcheck.org/sbl?bellsouth http://blackholes.us/ broadwing.blackholes.us http://blackholes.us/zones/isp/broadwing.classful ISP BROADWING http://hatcheck.org/google?broadwing; http://hatcheck.org/sbl?broadwing http://blackholes.us/ ciberlynx.blackholes.us http://blackholes.us/zones/isp/ciberlynx.classful ISP CYBERLYNX http://hatcheck.org/sbl?ciberlynx http://blackholes.us/ cogentco.blackholes.us reformed? - abuse@cogentco.com now acting on complaints but still too high at spamhaus.org http://blackholes.us/zones/isp/cogentco.classful http://mirror.bliab.com/bus/isp/ISP_COGENTCO.bz2 ISP COGENTCO http://hatcheck.org/sbl?cogentco http://blackholes.us/ cw.blackholes.us http://blackholes.us/zones/isp/cw.classful ISP CW.NET http://hatcheck.org/google?cw.net; http://hatcheck.org/sbl?cw http://blackholes.us/ cybercon.blackholes.us http://blackholes.us/zones/isp/cybercon.classful ISP CYBERCON http://hatcheck.org/google?cybercon; http://hatcheck.org/sbl?cybercon http://blackholes.us/ eli.blackholes.us probation 2002-10-17 - slowly cleaning up the mess see http://hatcheck.org/google?author:elipdx2002%40hotmail.com http://blackholes.us/zones/isp/eli.classful ISP ELI.NET http://hatcheck.org/google?eli.net; http://hatcheck.org/sbl?eli.net abuse@ acted on complaint within hours, 2002-11-13 http://blackholes.us/ he.blackholes.us http://blackholes.us/zones/isp/he.classful ISP HE.NET http://hatcheck.org/google?he.net; http://hatcheck.org/sbl?he.net http://blackholes.us/ hostnoc.blackholes.us http://blackholes.us/zones/isp/hostnoc.classful ISP HOSTNOC http://hatcheck.org/google?hostnoc; http://hatcheck.org/sbl?hostnoc http://blackholes.us/ inflow.blackholes.us http://blackholes.us/zones/isp/inflow.classful ISP INFLOW http://hatcheck.org/google?inflow; http://hatcheck.org/sbl?inflow http://blackholes.us/ infolink.blackholes.us http://blackholes.us/zones/isp/inflow.classful ISP INFOLINK http://hatcheck.org/google?infolink; http://hatcheck.org/sbl?infolink http://blackholes.us/ interbusiness.blackholes.us http://blackholes.us/zones/isp/interbusiness.classful ISP INTERBUSINESS http://hatcheck.org/google?interbusiness; http://hatcheck.org/sbl?interbusiness http://blackholes.us/ internap.blackholes.us http://blackholes.us/zones/isp/internap.classful ISP INTERNAP http://hatcheck.org/google?internap; http://hatcheck.org/sbl?internap http://blackholes.us/ lauderdale.blackholes.us http://blackholes.us/zones/isp/lauderdale.classful ISP LAUDERDALE Spamhost http://hatcheck.org/google?lauderdale.net; http://hatcheck.org/sbl?lauderdale http://blackholes.us/ level3.blackholes.us http://blackholes.us/zones/isp/level3.classful ISP LEVEL3 http://hatcheck.org/google?level3; http://hatcheck.org/sbl?level3 http://blackholes.us/ seems to actually kick spammers in early 2003 removed from ISP_SAFE 2003-05-17 pajo.blackholes.us http://blackholes.us/zones/isp/pajo.classful ISP PAJO http://hatcheck.org/google?pajo; http://hatcheck.org/sbl?pajo http://blackholes.us/ qwest.blackholes.us http://blackholes.us/zones/isp/qwest.classful ISP QWEST http://hatcheck.org/google?qwest; http://hatcheck.org/sbl?qwest http://blackholes.us/ rackspace.blackholes.us http://blackholes.us/zones/isp/rackspace.classful ISP RACKSPACE http://hatcheck.org/google?rackspace; http://hatcheck.org/sbl?rackspace http://blackholes.us/ rr.blackholes.us http://blackholes.us/zones/isp/rr.classful ISP ROADRUNNER; http://hatcheck.org/google?rr/roadrunner; http://hatcheck.org/sbl?rr http://blackholes.us/ sprint.blackholes.us http://blackholes.us/zones/isp/sprint.classful http://mirror.bliab.com/bus/isp/ISP_SPRINT.bz2 ISP SPRINT http://hatcheck.org/sbl?sprint http://spamhaus.org/sbl/listings.lasso?isp=telesp http://mirror.bliab.com/contrib/isp_telesp.bz2 http://spfilter.sourceforge.net/data/contrib/isp_telesp.bz2 ISP TELESP.BR http://hatcheck.org/google?telesp; http://hatcheck.org/sbl?telesp http://spamhaus.org/sbl/listings.lasso?isp=uu.net unfortunately not available at blackholes.us http://mirror.bliab.com/contrib/isp_uu.bz2 http://spfilter.sourceforge.net/data/contrib/isp_uu.bz2 ISP UU.NET http://hatcheck.org/google?uu.net; http://hatcheck.org/sbl?uu.net http://blackholes.us/ valuenet.blackholes.us http://blackholes.us/zones/isp/valuenet.classful ISP VALUENET http://hatcheck.org/google?valuenet; http://hatcheck.org/sbl?valuenet http://blackholes.us/ verio.blackholes.us http://blackholes.us/zones/isp/verio.classful ISP VERIO http://hatcheck.org/google?verio; http://hatcheck.org/sbl?verio http://blackholes.us/ classful data not yet available at blackholes.us wanadoo-fr.blackholes.us http://blackholes.us/zones/isp/wanadoo-fr.classful ISP WANADOO.FR http://hatcheck.org/google?wanadoo http://blackholes.us/ xo.blackholes.us http://blackholes.us/zones/isp/xo.classful ISP XO/CONCENTRIC http://hatcheck.org/google?concentric; http://hatcheck.org/sbl?xo http://blackholes.us/ yipes.blackholes.us http://blackholes.us/zones/isp/yipes.classful ISP YIPES http://hatcheck.org/google?yipes; http://hatcheck.org/sbl?yipes http://www.cymru.com/Documents/bogon-list.html http://mirror.bliab.com/bogo/BOGO.cidr.aggreg.gz http://www.cymru.com/Documents/bogon-bn-agg.txt http://www.cymru.com/Documents/bogon-bn-nonagg.txt BOGON ROUTE - http://openrbl.org/whois?i= experimental, entries expire only after few months expects PERMBLOCK, SPEWS and Relay/Proxylist http://mirror.bliab.com/contrib/risky_net.bz2 http://spfilter.sourceforge.net/data/contrib/risky_net.bz2 NULL incomplete, includes dsl-ranges, usually added after spam warning: braeks a couple of legit mailservers on static dsl http://mirror.bliab.com/contrib/badhost_dyna.bz2 http://spfilter.sourceforge.net/data/contrib/badhost_dyna.bz2 ADSL/CABLE/DIALUP neutralize entries in other lists http://mirror.bliab.com/contrib/badhost_ignore.bz2 http://spfilter.sourceforge.net/data/contrib/badhost_ignore.bz2 NULL # WARNING: sources below contain hostnames and email-addresses # not all application can handle (mixed) addr and host http://abuse.easynet.nl/spamlist-usage.html http://informatie.easynet.nl/error/errors.html#address ATTN: name changed to easynet.nl 2003-05-17 contains ~45000 hostnames and email-addresses rsync://informatie.easynet.nl:6666/spamblock/spamlist-extended.txt SpamList applied to both email and reverse-dns http://mirror.bliab.com/contrib/risky_dom.bz2 http://spfilter.sourceforge.net/data/contrib/risky_dom.bz2 BadFrom use only if your filter handles the tag 'FREEMAIL' http://mirror.bliab.com/contrib/badfrom_freemail.bz2 http://spfilter.sourceforge.net/data/contrib/badfrom_freemail.bz2 FREEMAIL use only if your filter handles the tag 'IGNORE' http://mirror.bliab.com/contrib/badfrom_ignore.bz2 http://spfilter.sourceforge.net/data/contrib/badfrom_ignore.bz2 IGNORE # entries used for testing and quality control (soon...) http://spfilter.sourceforge.net/ used with the spfilter Makefile: 'make test' manual usage: 'perl ./spfilter.pl -v -d TEST_LIST' http://mirror.bliab.com/contrib/test_list.bz2 http://spfilter.sourceforge.net/ manual usage: 'perl ./spfilter.pl -v -d TEST_AXFR' \.exception$ http://mirror.bliab.com/contrib/test_axfr.bz2 # output format options, all keys optional # notation (notation): use 'reverse' for dns (default 'octet') # option=[bindhack|tinydnshack|tcpserverhack]: special processing # head (string): prepended on each line, usually empty # separator (string): between $addr and $text (default "\t") # tail (string): appended after $text (default none) # magic_update (boolean): preserve lines not inserted by spfilter # keys listed below may not work: (run spfilter with argument -o) # outdir (string) write generated list into this directory # outfile (string): specify individual filename of generated list # macros: {AGENT}, {YYMMDD}; for dnsbl: {ZONE}, {ADDR}, {TTL} # todo: macros {OUTFILE}, {SOURCES}, {HOSTNAME} same as octets.tab, but for use with hostnames and badfrom legacy, will be removed soon # experimental extensions by {AGENT}: # EXCEPTION, IGNORE or DUNNNO: do not include any matching records in output # WHITELIST, OK or 250: pass entry, sendmail will whitelist on this keyword # FREEMAIL or MXCHECK: pass entry, rcptfilter will deny if not from mx http://www.sendmail.org/m4/anti-spam.html # reference see http://www.sendmail.org/m4/anti-spam.html Connect:10 RELAY Connect:127.0.0 RELAY Connect:192.168 RELAY To:abuse@ SPAMFRIEND To:postmaster@ SPAMFRIEND To:nofilter@ SPAMFRIEND 127.0.0.2 553 Test sendmail_access {AGENT} (20{YYMMDD}) # run 'makemap hash /etc/mail/access < SPFILTER.sendmail' "553 " http://www.postfix.org/ # reference see http://www.postfix.org/access.5.html 10 OK 127.0.0 OK 192.168 OK 127.0.0.2 553 Test postfix {AGENT} (20{YYMMDD}) # needs: smtpd_client_restrictions = check_client_access hash:/usr/local/etc/postfix/spfilter_access, ... 553 http://www.qmail.org/ tcprules also takes notation 'ranges' (not implemented) # qmail with consolidated anti-uce patches # run tcprules tcprules.dat tcprules.tmp < ./outdir/SPFILTER.qmail_uce 10.:allow,DENYMAIL="" 127.0.0.:allow,DENYMAIL="",RELAYCLIENT="" 192.168.:allow,DENYMAIL="" 127.0.0.2:allow,DENYMAIL="553 Test qmail_uce {AGENT} (20{YYMMDD})" :allow,DENYMAIL=" " http://cr.yp.to/ucspi-tcp/rblsmtpd.html # rblsmtpd only returns temporary error (451) by default # use 'rblsmtpd -b -C' for permanent and failsafe rejection (553) # run 'tcprules tcprules.dat tcprules.tmp < ./outdir/SPFILTER.rblsmtpd' 10.:allow,RBLSMTPD="" 127.0.0.:allow,RBLSMTPD="",RELAYCLIENT="" 192.168.:allow,RBLSMTPD="" 127.0.0.2:allow,RBLSMTPD="Test rblsmtpd {AGENT} (20{YYMMDD})" :allow,RBLSMTPD=" " http://cr.yp.to/ucspi-tcp/tcpserver.html just to keep them out of the maillog... drop connection on sight, insane clients may dos you for that tcpserver requires 'option="tcpserverhack"', append dot to partial octets :deny,DENYMAIL=" " http://courier-mta.org/ makedat also takes 'cidr' and 'ranges' if Net::CIDR installed # courier-mta etc/smtpaccess 10 allow,BLOCK="",RELAYCLIENT,REQUIRECERT="NO",BOFHBADMIME="accept" 127.0.0 allow,BLOCK="",RELAYCLIENT,REQUIRECERT="NO",BOFHBADMIME="accept" 192.168 allow,BLOCK="",RELAYCLIENT,REQUIRECERT="NO",BOFHBADMIME="accept" 127.0.0.2 allow,BLOCK="Test courier {AGENT} (20{YYMMDD})" # run '/usr/libexec/courier/bin/makesmtpaccess' allow,BLOCK="553 " just to keep them out of the maillog... deny,BLOCK=" " http://www.exim.org/ working config examples needed! # exim needs: host_reject_recipients = net-lsearch;/etc/mail/host_reject # note: exim also supports cdb as generated by spfilter 127.0.0.2:Test exim {AGENT} (20{YYMMDD}) : http://www.sleepycat.com/docs/utility/ null-terminated, compatible with postfix and C compile: db_load -f SPFILTER.db_dump -T -t btree SPFILTER.db ATTN: dont mess up format definition below VERSION=3 format=print type=btree HEADER=END \00 \00 ,"553 " http://www.corpit.ru/mjt/rbldnsd/ no options needed at all :127.0.0.2:http://openrbl.org/$ dnsbl performance test ; #server {ADDR} ; #port 53 ; #maxwait 1 .{ZONE} A ; .{ZONE} TXT specify name and ip with -z {ZONE},{ADDR},{TTL} bind requires option=bindhack, limits txt to 255 chars and changes commentchar to ; delegate zone {ZONE} to nameserver at {ADDR} ; bind zone {ZONE}., nameserver on [{ADDR}] ; in named.conf specify: zone "{ZONE}" { type master; file "SPFILTER.bind"; }; $TTL {TTL} ; {default ttl for positive answers} $ORIGIN {ZONE}. @ SOA {ZONE}. root.{ZONE}. ( 20{YYMMDD}00 ; serial no. 10800 ; refresh {interval for syncing slaves} 3600 ; retry {retry per hour on failures} 604800 ; expire {remove dead slave zone after 7 days} 21600) ; minimum {ttl for negative answers} ; authoritative nameserver @ 86400 NS {ZONE}. @ 86400 MX 100 {ZONE}. ; {mailserver assumed on same address} @ 86400 A {ADDR} ; {website assumed on same address} www 86400 A {ADDR} ; {website assumed on same address} ; test-entries about TXT "zone built by {AGENT} (20{YYMMDD})" 2.0.0.127 TXT "Test bind {ZONE} [{ADDR}] (20{YYMMDD})" 2.0.0.127 A 127.0.0.2 ; {every dnsbl should have that} TXT " " A 127.0.0.2 specify name and ip with -z {ZONE},{ADDR},{TTL} tinydns requires option="tinydnshack", expand macro {ZONE} and transform : delegate zone {ZONE} to nameserver at {ADDR} # statically define zone '{ZONE}' at address {ADDR} for tinydns Z.{ZONE}:{ZONE}:root.{ZONE}.:20{YYMMDD}00:14400:3600:604800:28800:{TTL}: &{ZONE}::{ZONE}:86400: ^{ADDR}:{ZONE}:86400: @{ZONE}::{ZONE}:100:86400: +{ZONE}:{ADDR}:86400: +www.{ZONE}:{ADDR}:86400: '2.0.0.127.{ZONE}:Test {ZONE} {AGENT} {YYMMDD} http\072//spfilter.sourceforge.net/: +2.0.0.127.{ZONE}:127.0.0.2:{TTL} # run 'cp ./outdir/SPFILTER.tinydns ./data; tinydns-data' # test1: dig @{ADDR} 2.0.0.127.{ZONE} any # test2: dig 2.0.0.127.{ZONE} any ' .{ZONE}: + .{ZONE}:127.0.0.2:{TTL} parse sources into mysql # created by {AGENT} on 20{YYMMDD} DROP TABLE IF EXISTS spfilter; CREATE TABLE spfilter ( addr varchar(16) NOT NULL default '', text varchar(127) NOT NULL default '', KEY addr (addr) ); # query: SELECT * from spfilter WHERE addr='$a.$b.$c.$d' OR addr='$a.$b.$c'; # tip: insert into non-indexed db and create the index later will be faster # note: sould really use LOAD DATA INFILE and read from csv above INSERT INTO spfilter VALUES (' ',' '); -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iD8DBQE/px9tBR/CjSa9zvMRAqE4AJ0QPJcecQf6OgYaR7uDTM/LyCr7DwCgiQ3z Vv+CVN3DculC9744lyXg1j8= =OoXg -----END PGP SIGNATURE-----